Google Search Console

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:49 AM UTC
• Version: 1.3.0

Overview

This skill is a read-only Google Search Console helper with disclosed OAuth setup and bounded API querying; the main residual risk is normal credential handling plus unpinned Python dependencies.

Install this only if you are comfortable granting read-only access to your Google Search Console data. Keep the OAuth client secret and token files private, use an isolated Python environment, and consider pinning dependencies or using a lockfile before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–3
Vulnerability Type: Unpinned dependencies without integrity hashes
Risk Level: Medium

Vulnerable Code

text

google-api-python-client>=2.100
google-auth>=2.23
google-auth-oauthlib>=1.2

Technical Analysis

All three dependencies use open-ended minimum-version constraints. Consequently, installation can select any newer package version available from the configured package index. The project also provides no lock file or cryptographic hashes to verify the exact artifacts being installed.

This does not establish that any currently permitted release is malicious. It creates a supply-chain exposure in which future, compromised, or otherwise unreviewed releases may be installed without a corresponding change to the audited project. These packages are especially sensitive because they participate in OAuth credential handling and authenticated Google Search Console communication.

Attack Path

1. An attacker compromises a future permitted release, its maintainer account, distribution infrastructure, or the package source configured by the user.
2. A user follows the installation instructions and installs the requirements.
3. The resolver selects the attacker-controlled release because the open-ended version constraint permits it.
4. Malicious package code executes during installation or when imported by gsc_auth.py or gsc_query.py.
5. The code accesses data available to the process, potentially including OAuth client credentials, stored access or refresh tokens, and returned Search Console information.

This path requires compromise or substitution of a dependency artifact; no direct remote-code-execution path exists solely from the project’s own source code.

Impact Assessment

Successful exploitation would execute code with the operating-system privileges of the user running the skill. It could read that user’s accessible files and environment, steal OAuth c ...[truncated 303 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace open-ended constraints with exact, reviewed versions, for example package==x.y.z.
2. Generate a reproducible lock file containing cryptographic hashes for every direct and transitive dependency.
3. Install with hash verification enabled, such as pip install --require-hashes -r requirements.lock.
4. Restrict package retrieval to the official, authenticated package index or a controlled internal mirror.
5. Review and test dependency upgrades before updating the lock file.
6. Add automated dependency vulnerability and provenance scanning to the release process.
7. Continue installing dependencies in an isolated environment, as already recommended by the project documentation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Install the dependencies declared in `{baseDir}/requirements.txt` in an isolated Python environment. In Google Cloud, create a **Desktop app** OAuth client with the Search Console API enabled and the `webmasters.readonly` scope.

Store the downloaded client JSON at `~/.config/gsc/client_secret.json` or pass a different protected path with `--client-secrets`. The credential file and token file must be owned by the current user with mode `0600`; each immediate parent directory must reject group/other access, normally mode `0700`. Never paste a client secret, authorization code, refresh token, or access token into chat or a command argument.

Run the supported installed-app loopback flow:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gsc_auth.py (reported line 18)May include surrounding context.

python

Install the dependencies declared in `{baseDir}/requirements.txt` in an isolated Python environment. In Google Cloud, create a **Desktop app** OAuth client with the Search Console API enabled and the `webmasters.readonly` scope.

Store the downloaded client JSON at `~/.config/gsc/client_secret.json` or pass a different protected path with `--client-secrets`. The credential file and token file must be owned by the current user with mode `0600`; each immediate parent directory must reject group/other access, normally mode `0700`. Never paste a client secret, authorization code, refresh token, or access token into chat or a command argument.

Run the supported installed-app loopback flow:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Install the dependencies declared in `{baseDir}/requirements.txt` in an isolated Python environment. In Google Cloud, create a **Desktop app** OAuth client with the Search Console API enabled and the `webmasters.readonly` scope.

Store the downloaded client JSON at `~/.config/gsc/client_secret.json` or pass a different protected path with `--client-secrets`. The credential file and token file must be owned by the current user with mode `0600`; each immediate parent directory must reject group/other access, normally mode `0700`. Never paste a client secret, authorization code, refresh token, or access token into chat or a command argument.

Run the supported installed-app loopback flow:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes capabilities that involve reading local files, writing token material, invoking Python scripts, and making network calls to Google APIs, but it does not declare any explicit tool/permission scope. That mismatch weakens policy enforcement and review because an agent may be granted broader effective capabilities than the manifest communicates.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## Setup

Install the dependencies declared in `{baseDir}/requirements.txt` in an isolated Python environment. In Google Cloud, create a **Desktop app** OAuth client with the Search Console API enabled and the `webmasters.readonly` scope.

Store the downloaded client JSON at `~/.config/gsc/client_secret.json` or pass a different protected path with `--client-secrets`. The credential file and token file must be owned by the current user with mode `0600`; each immediate parent directory must reject group/other access, normally mode `0700`. Never paste a client secret, authorization code, refresh token, or access token into chat or a command argument.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

## Failure boundary

Malformed rows, freshness metadata, filters, dates, properties, URLs, or pagination fail the whole request. Provider errors are summarized without returning response bodies that could contain sensitive details. Do not broaden the OAuth scope or retry indefinitely to work around authorization, quota, or provider failures.

Official references: [Search Analytics query](https://developers.google.com/webmaster-tools/v1/searchanalytics/query), [URL Inspection](https://developers.google.com/webmaster-tools/v1/urlInspection.index/inspect), and [installed-app OAuth](https://developers.google.com/identity/protocols/oauth2/native-app).

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified with only a lower bound, which allows future major or minor releases to be installed without review. That can introduce breaking changes or a compromised/upstream-vulnerable version through the supply chain, reducing build reproducibility and increasing exposure to dependency risk.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

google-api-python-client>=2.100
google-auth>=2.23
google-auth-oauthlib>=1.2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Using an unpinned minimum version for an authentication library permits unreviewed newer releases to be pulled during installation. For auth-related packages, unexpected upstream changes can affect security posture, reliability, or introduce vulnerable versions indirectly.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

google-api-python-client>=2.100
google-auth>=2.23
google-auth-oauthlib>=1.2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The OAuth client library is not pinned, so environments may resolve to different versions over time. This weakens reproducibility and can expose the skill to supply-chain risk or regressions in a security-sensitive dependency path.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

google-api-python-client>=2.100
google-auth>=2.23
google-auth-oauthlib>=1.2

Static analysis

No suspicious patterns detected.